- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Aquila I AI SOC
Your SIEM raised thousands of alerts overnight. Most needed a first look, not an analyst — Aquila I AI SOC puts your logs in one security lakehouse and lets AI micro-agents triage, hunt and propose containment, with analysts supervising every decision in a single Workbench — sold with SOAR-style response as Aquila I UDR.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Aquila I platform family
This page covers Aquila I AI SOC — with the UDR solution folded in. The rest of the Aquila I platform:
Quick facts
30-second orientation- Product
- AI-native SIEM and triage: a security lakehouse, AI micro-agents and an analyst Workbench with UBA
- Maker
- Aquila I Solutions Pvt. Ltd., Thane, Maharashtra; founded 2020; no outside funding reported (Tracxn)
- Packaging
- Sold with SOAR-style response as Unified Detection & Response (UDR), an Aquila I solution bundle
- Price
- Quote-only; no published price, no INR list and no published ingest or licence meter
- Deployment
- Cloud-native SaaS with 24×7 support by Aquila I’s account; an on-premises option is not documented
- Data model
- OCSF-aligned normalisation into the lakehouse; the connector list is not published
- Datasheet
- Dated February 2026; Aquila I claims it cuts mean time to respond from hours to seconds
- Track record
- No analyst placement; Aquila I publishes no named customer case studies for AI SOC
- India
- Built in India, but the SaaS hosting region and the log retention period are not published
- In India via
- TechBag — source mapping, connector check, quote in INR with GST, pilot support
Understand an AI-native SOC before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is an AI-native SOC?
A SIEM where AI agents take the first pass at every alert and analysts supervise the decisions they make.
A rule-based SIEM and an L1 queue vs Aquila I AI SOC — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A rule-based SIEM and an L1 queue | Aquila I AI SOC |
|---|---|---|
| First look at an alert | An L1 analyst working a rule queue | A micro-agent classifies, enriches and ranks it |
| Investigation | Pivoting across separate consoles | One timeline: cloud, endpoint, identity, network |
| Data model | Each source parsed its own way | One OCSF-aligned schema in a lakehouse |
| Threat hunting | When an analyst finds the time | Hunting agents running over retained data |
| Proving detections work | An annual penetration test | BAS and CART results fed back in, under UDR |
| What it is NOT | — | An MDR service, an on-prem SIEM, or a published price |
The cheapest test is a slice of the estate: feed a few high-value sources, let the agents triage beside your SIEM for a month, and compare verdicts.
The four pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Lakehouse
Telemetry is ingested at full fidelity into Aquila I’s own security lakehouse, which its UDR page describes as write-once storage with schema enforcement at ingestion and no sampling.
OCSF
Each source is mapped to an OCSF-aligned schema, so one rule can run across cloud, endpoint, identity and network data; which sources have ready connectors is not published.
Micro-agents
Agents each specialise in triage, investigation, hunting, enrichment, prioritisation or containment, working on lakehouse data; kill-chain models predict the next step.
Workbench
The Workbench tracks case lifecycle, SLA timers, assignment and risk scores, shows explainable AI traces, and keeps autonomous actions under policy-bound human oversight.
Logs into one OCSF-aligned lakehouse — micro-agents triage, hunt and contain, with analysts supervising in the Workbench.
Nine capabilities. Ingest, investigate, respond.
Aquila I AI SOC hands the first pass at every alert to AI micro-agents working on one lakehouse — and keeps analysts in charge.
Full-fidelity telemetry
Logs are kept at full fidelity in the lakehouse, which the hunting agents search back over; the retention period is not published.
One schema across sources
OCSF-aligned normalisation puts mixed logs into one consistent schema, so correlation and detection rules work across every data domain.
Dark-web and exposure feeds
In Aquila I’s UDR design, leaked credentials found by its DRP product raise identity risk, and ASM exposure data reorders alerts.
Alerts classified by agents
Micro-agents classify each alert, enrich the investigation and rank incidents by dynamic risk; Aquila I says triage takes milliseconds.
Attack narratives, not alerts
Events from cloud, endpoint, identity and network are stitched into one adversary timeline that the analyst works as a single case.
Behaviour analytics built in
Embedded user behaviour analytics baselines normal activity and flags identity misuse, privilege escalation and anomalous access.
Policy-bound response
Containment and remediation workflows run inside governance controls you set, with each action auditable, traceable and overseen.
Cases, SLAs, explanations
The Workbench carries case lifecycle, SLA timelines, assignment and explainable AI tracing, so an analyst can see why an agent acted.
Detections that learn
Analyst decisions and incident outcomes feed back into detection logic; under UDR, BAS and CART results arrive as labelled benchmarks.
Most alerts need a first look, not an analyst. Aquila I AI SOC gives that look to supervised agents.
Here’s what genuinely sets it apart — and exactly where it stops.
A SOC built around agents, not a rule queue
Aquila I designed AI SOC so that specialised micro-agents, not analysts, take the first pass at every alert: they classify, enrich, rank by risk and propose containment, while kill-chain models look ahead. Analysts work cases in the Workbench, where each agent decision carries an explainable trace and oversight stays human.
One lakehouse under detection, intel and testing
Logs, Aquila I’s own dark-web and attack-surface findings, and its BAS and CART simulation results all land in the same OCSF-aligned lakehouse. That is the point of the UDR packaging: a leaked credential can raise an identity’s risk score, and every simulated attack tests whether a detection fired.
An Indian vendor with an Indian channel
Aquila I is a bootstrapped company from Thane, with BD Soft appointed its national distributor in 2022 and a multi-tenant MSSP partner programme. For buyers who want the maker in their own time zone, that counts. India origin is not data residency, though: the hosting region still has to be confirmed in writing.
Where it stops
No price, licence meter, retention period, connector list or hosting region is published, and no on-premises form is documented. Aquila I publishes no named customer case studies and holds no analyst placement. It is software for your SOC team or an MSSP, not a managed detection service with analysts included.
The numbers behind the platform
What your Aquila I AI SOC rollout looks like
List sources and the retention rule
Inventory log sources across cloud, endpoint, identity and network, and set the retention CERT-In and your regulator require.
Get region, meter and connectors in writing
Ask Aquila I where the SaaS runs, what the licence counts, how long data stays and which of your sources have connectors.
Pilot on a slice of the estate
Feed a few high-value sources into the lakehouse, let the agents triage beside your current SIEM, and compare their verdicts.
Set the autonomy boundaries
Decide which containment actions may run on their own, which need an analyst, and how traces are reviewed in the Workbench.
Decide the UDR scope
Choose whether DRP, ASM, BAS or CART feeds join the lakehouse under UDR, and get the final quote itemised in INR with GST.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“The micro-agents closed most low-risk alerts before our L1 shift began, and every closure carried a trace we could audit.”
“Identity, endpoint and cloud events on one timeline cut our hand-offs between three consoles during investigations.”
“A leaked password from their dark-web feed raised that user’s risk score the same morning. That link sold the pilot.”
“We run it for several clients as an MSSP; the Workbench SLA timers match how we report to each customer every month.”
“Our auditor asked where the logs sit for CERT-In. No document named the region, so we had it written into the contract.”
“Solid triage, young documentation: the connector list for our firewalls and plant historians came only after two calls.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the SIEM market — tap any vendor to see why it sits where it does.
TechBag SIEM Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Quote-only; young product with no analyst placement or case studies.
Data Placement × Built-in Automation
The grid nobody publishes — how freely you can choose where SIEM data lives, India included, vs how much AI triage, UEBA and response comes built in.
Agents, UBA and response built in; region and on-prem unpublished.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Aquila I AI SOC vs the SIEM field
Against Microsoft Sentinel, Palo Alto Cortex XSIAM, Google Security Operations, Securonix Unified Defense SIEM and Exabeam New-Scale SIEM — on deployment, data, AI agents, UEBA, SOAR, retention, price, India and exit.
| Dimension | Aquila I AI SOC | Microsoft Sentinel | Palo Alto Cortex XSIAM | Google Security Operations | Securonix Unified Defense SIEM | Exabeam New-Scale SIEM |
|---|---|---|---|---|---|---|
| What it is | AI-native SIEM + triage | Cloud SIEM on Azure | AI-led SecOps platform | SIEM, SOAR and intel | UEBA-led cloud SIEM | UEBA-led cloud SIEM |
| Deployment | Cloud SaaS only | SaaS on Azure only | Cloud only | SaaS on Google Cloud | Cloud; BYO Snowflake | Cloud + on-prem sibling |
| Data foundation | Lakehouse + OCSF | Log Analytics + lake | All data, one platform | GB-capped, YARA-L | Snowflake data lake | Logs + Smart Timelines |
| AI triage and agents | Micro-agents + Workbench | Security Copilot | AI incident stitching | Gemini in Enterprise | Sam, priced separately | Nova: seven agents |
| Behaviour analytics | Embedded UBA | UEBA included | Not itemised | In Enterprise tier | UEBA at the core | UEBA-led detection |
| SOAR and response | Included, via UDR | Logic Apps, billed apart | SOAR included | SOAR included | SOAR included | Basic automation |
| Retention included | Not published | 90 days included | Not on TechBag’s page | 12 months hot | 365 days hot | Set per mandate |
| Intel and exposure context | Own DRP and ASM feeds | Intel + Defender XDR | Unit 42 + ASM | Mandiant + VirusTotal | Threat intel included | Ask Exabeam |
| Pricing model | Quote; meter unknown | Per GB ingested | Ingest and scope | Package + GB cap | GB/day bands | GB/day tiers |
| Published entry price | Not published | ~$4.30/GB PAYG | Not published | Not published | Not published | ~$36K/yr at 50 GB/day |
| India data region | Not published | India storage regions | Not documented | Not documented | BYO lake in India | No India region |
| Track record | No placement or cases | 2025 MQ Leader | QRadar SaaS successor | 2025 MQ Leader | 2025 MQ Leader | 2025 MQ Leader |
| Lock-in and exit | Export terms unknown | KQL rewrite to leave | A platform bet | YARA-L rewrite | Data in your Snowflake | Two-platform roadmap |
| Best fit | Indian SOCs and MSSPs | Microsoft estates | SIEM replacers | Retention-heavy estates | Cloud, behaviour-first | UEBA-led, cloud or not |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Aquila I AI SOC if…
- ✓You want an Indian-built SIEM where AI agents take the first pass at alerts and analysts keep oversight in one Workbench
- ✓You also want dark-web, attack-surface and breach-simulation results feeding the same detections, under Aquila I UDR
- ✓You run a lean in-house SOC or an MSSP practice and can prove the product on a pilot rather than on references
Compare alternatives if…
- ✓Logs must be stored in an Indian region you can name today — Microsoft Sentinel documents Central India and Jio regions
- ✓You need a published rate to budget against — Sentinel prints per-GB prices and Exabeam has a reported 2023 list
- ✓Long hot retention is the requirement — Google includes twelve months and Securonix a full year as standard
Do not expect…
- ✓A published price, licence meter, retention period or connector list for AI SOC
- ✓An on-premises or air-gapped deployment, or analysts included as a managed service
- ✓Named customer case studies or an analyst placement to lean on in procurement
Aquila I AI SOC is one of 36 SIEM and log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
What does first-pass alert triage cost you?
Drag the sliders (servers, endpoints and cloud accounts you monitor; analyst-hour cost). Estimates model the analyst time spent on first-pass alert triage at an assumed 1.5 hours per monitored asset a year, with 70% of it taken over by supervised AI triage. Both figures are TechBag assumptions, not Aquila I data. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote only. Aquila I publishes no price for AI SOC, no INR list and no licence meter, so whether ingest, assets, users or analysts are counted is the first question to ask. The retention period, connector list and hosting region are not published either. UDR adds SOAR-style response and lets Aquila I’s DRP, ASM, BAS and CART products feed the same lakehouse; each is quoted as its own line. TechBag maps your log sources first, then gets the quote itemised in INR with GST.
Aquila I AI SOC
Best for SOC teams wanting AI-led triage
- Quoted; no published licence meter
- Lakehouse, micro-agents, UBA, Workbench
- Cloud SaaS; get the region in writing
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Aquila I UDR
Best for one platform from intel to testing
- AI SOC plus SOAR-style response
- DRP, ASM, BAS and CART feed the lakehouse
- Each product quoted as its own line
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Where does the AI SOC tenant run, where do logs and cases rest, and will Aquila I commit that region in the contract?
What does the quote count — GB ingested, events, assets, users or analysts — and what happens when volume grows?
How many days of logs stay hot and searchable, and does that meet CERT-In’s 180-day rule without a second archive?
Which of your log sources have ready connectors today, and which need a custom parser? Get the list against your stack.
Which containment actions can agents take without approval, and how are those limits set, logged and audited?
Is any on-premises or private-cloud deployment possible, or is SaaS the only option? Aquila I documents none today.
Aquila I publishes no named customer case studies; can it arrange a reference call with a comparable Indian SOC?
In what format can you export raw logs, cases and detections if you leave, and how long is data held after the term?
Questions buyers ask
Ready to evaluate Aquila I AI SOC?
List your log sources and retention mandate first, or let a TechBag advisor get the region, meter and connector answers in writing before a pilot beside your current SIEM.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.